c3f1d3ebe17733cb6efb49462233e005e217fcc8577286fbf7ba2fd8ec4f5ee5

Analysis

max time kernel
50s
max time network
48s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
08/08/2022, 02:04

Target
DHL Express Receipt.exe
Size 881KB
Sample220808-chabcsdgd7
SHA256 c3f1d3ebe17733cb6efb49462233e005e217fcc8577286fbf7ba2fd8ec4f5ee5
MD5 c53458b3d1584873b188b172200bf2be
SHA1 0844764e372d297d9cf928b08bd59a3ada16a556
SHA512 e242312a4b975f2cf4d6f10d12f64d0e821d5aa9743cb17a770ad559b420cacfb31b327ce55379a5ba62d3386dec431b736a054e3f7dd63a2ef8101432c547b1
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1432	DHL Express Receipt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1432	DHL Express Receipt.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1432	DHL Express Receipt.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2012	1432	DHL Express Receipt.exe	27
PID 1432 wrote to memory of 2012	1432	DHL Express Receipt.exe	27
PID 1432 wrote to memory of 2012	1432	DHL Express Receipt.exe	27
PID 1432 wrote to memory of 2012	1432	DHL Express Receipt.exe	27
PID 1432 wrote to memory of 2024	1432	DHL Express Receipt.exe	28
PID 1432 wrote to memory of 2024	1432	DHL Express Receipt.exe	28
PID 1432 wrote to memory of 2024	1432	DHL Express Receipt.exe	28
PID 1432 wrote to memory of 2024	1432	DHL Express Receipt.exe	28
PID 1432 wrote to memory of 2028	1432	DHL Express Receipt.exe	29
PID 1432 wrote to memory of 2028	1432	DHL Express Receipt.exe	29
PID 1432 wrote to memory of 2028	1432	DHL Express Receipt.exe	29
PID 1432 wrote to memory of 2028	1432	DHL Express Receipt.exe	29
PID 1432 wrote to memory of 1476	1432	DHL Express Receipt.exe	30
PID 1432 wrote to memory of 1476	1432	DHL Express Receipt.exe	30
PID 1432 wrote to memory of 1476	1432	DHL Express Receipt.exe	30
PID 1432 wrote to memory of 1476	1432	DHL Express Receipt.exe	30
PID 1432 wrote to memory of 1900	1432	DHL Express Receipt.exe	31
PID 1432 wrote to memory of 1900	1432	DHL Express Receipt.exe	31
PID 1432 wrote to memory of 1900	1432	DHL Express Receipt.exe	31
PID 1432 wrote to memory of 1900	1432	DHL Express Receipt.exe	31

C:\Users\Admin\AppData\Local\Temp\DHL Express Receipt.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Express Receipt.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Users\Admin\AppData\Local\Temp\DHL Express Receipt.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Express Receipt.exe"
  2⤵
  PID:2012
- C:\Users\Admin\AppData\Local\Temp\DHL Express Receipt.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Express Receipt.exe"
  2⤵
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\DHL Express Receipt.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Express Receipt.exe"
  2⤵
  PID:2028
- C:\Users\Admin\AppData\Local\Temp\DHL Express Receipt.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Express Receipt.exe"
  2⤵
  PID:1476
- C:\Users\Admin\AppData\Local\Temp\DHL Express Receipt.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Express Receipt.exe"
  2⤵
  PID:1900

memory/1432-54-0x00000000000A0000-0x0000000000182000-memory.dmp

Download

memory/1432-55-0x0000000076031000-0x0000000076033000-memory.dmp

Download

memory/1432-56-0x00000000006B0000-0x00000000006D0000-memory.dmp

Download

memory/1432-57-0x00000000006D0000-0x00000000006DC000-memory.dmp

Download

memory/1432-58-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1432-59-0x0000000004270000-0x0000000004290000-memory.dmp

Download

memory/1432-60-0x0000000004D75000-0x0000000004D86000-memory.dmp

Download